The maintainers of Ruby on Rails have pushed out the second update in a week to fix a critical hole in the framework which allows attackers to compromise applications. The "two extremely critical security fixes " close off parameter parsing flaws present in all versions of Ruby on Rails which allows attackers to bypass authentication and execute arbitrary code in Rails apps. "There are multiple weaknesses in the parameter parsing code for Ruby on Rails which allows attackers to bypass authentication systems, inject arbitrary SQL, inject and execute arbitrary code, or perform a DoS attack on a Rails application," an advisory stated . "Due to the critical nature of this vulnerability, and the fact that portions of it have been disclosed publicly, all users running an affected release should either upgrade or use one of the work-arounds immediately." Attackers could take adva...